🎥 Video Link

Transcript

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

What I want to demonstrate today is how any app on Android can steal your data using your clipboard.

On the left side of my screen, have a Pixel eight running stock Pixel OS. In the center, I have a Pixel seven running Graphene OS. And on the right side of my screen I have my clipboard receiver which I’ll talk a little bit more about shortly.

So in order to make this as realistic as possible, I cobbled together a currency converter app. We’ll go ahead and open that. To me this was a realistic app that anyone might download and use. If you need to convert a currency from your local one to something else you can do it through the app.

When you select a different currency a network request is made to get the current rate, so a network connection is required by the app. And just to confirm that this app has no permissions, let’s check the permissions on both devices.

So on the Pixel eight running stock Pixel OS we can see there are no permissions granted. On the Graphene OS device we do see the network permission is granted, but we don’t see that on the stock Pixel device. The reason for that is Graphene OS gives the users that option, other OS’s do not.

So in this scenario we’re going to pretend that you copied your address to your clipboard earlier in the day. Maybe you’re moving and had to send it to a few different people. So that’s in your clipboard. You copied it. You sent it to your friends through Signal because all your friends are privacy conscious. Wouldn’t that be nice?

Then a little bit later in the day you wanted to purchase something online in a different currency. You didn’t know how much would cost in your local currency, so you want to use the handy app you downloaded. So on the bottom you might notice that pop up currency converter pasted from your clipboard.

If we now look at the clipboard receiver on the right side of the screen we see both of the names and addresses from the Google Pixel seven and the Google Pixel eight that we copied earlier.

So what exactly happened here?

On Android OS any app that is in the foreground, which is the app that you’re currently using, has permission to read from your clipboard. So in the currency converter app that I made, I have it read from your clipboard every time it comes to the foreground.

The reason for that, for your convenience, maybe I read the number you have copied to your clipboard so you don’t need to paste it. But what else this app does is while reading it from your clipboard it also posts that data to a remote endpoint regardless of the content.

So in this case as you saw again another paste came through. So every time the app is loaded your clipboard is red. I can play it off as for your convenience, but really I am sending that data remotely to a database, logging it, and storing it for later.

So here we have this seemingly innocent app. There’s no play services required. There’s no ads inside it. No data was required from you to sign up. No email, no name, nothing like that. But because apps can read from your clipboard it was able to exfiltrate your data without any authorization from you.

And if that’s not bad enough, let’s say that later in the day you want to send one of your friends a spicy photo. Again, you’re gonna send it through signal because you want it to be private and end to end encrypted.

So if we go back inside the app, again currency converter pasted from your clipboard. That took a minute, this is kind of a large photo. But we can see that the photos that were in the clipboards on the devices were sent remotely as soon as the currency converter app was brought into the foreground.

Those photos were exfiltrated to a remote server without any permission being required and are now stored and available to the developer of the app for any purpose at a later time.

I think this scenario is pretty realistic. We all have something in our clipboard at any given time.

Unfortunately, on stock Pixel OS there’s not much you can do about it. You saw that that notification exists, so make sure you do have that enabled if you are not on Graphene OS. To do that go into Settings, Security and Privacy, Privacy Controls, and make sure Show Clipboard Access is toggled on.

So you will see that notification if you do see it. Maybe consider using a different app, reach out to the developer, try and figure out why they’re using that feature. But there’s not much more you can do about it.

So stock Pixel OS we’ll get that out of the way. But on Graphene OS the team recently added the secure paste feature and what this does is when enabled apps will be unable to read clipboard content added by other apps.

It’s also worth noting that some apps including apps written in Flutter implement their own text selection toolbar. GrapheneOS works around this by adding a paste button to the default keyboard. So besides being a terrible UX design by commandeering your system copy and paste, GrapheneOS did add a workaround for this which I will demonstrate shortly.

So on Graphene OS if you want to enable this you must be in the owner user otherwise you won’t see the global toggle for this. So swipe up, go into settings, scroll down to security and privacy, select Privacy Controls, and the new option added is Clipboard Access. So tap on that.

At the top make sure the Show Clipboard Access is enabled and that’ll show a message whether the clipboard access was blocked or allowed. The new toggle added that you want to disable does this allow apps to read the clipboard. I know it sounds a little bit backwards but you want to toggle that off so apps are now not allowed to read your clipboard.

So with that disabled let’s go and make sure this image is still in my clipboard. I’m gonna copy that again and now I’m going to, well first let me get the receiver open again, make sure it’s cleared out.

And if we now open the currency converter we can see at the bottom currency converter was blocked from accessing your clipboard. And if you look in the clipboard receiver nothing shows up there. So with that option disabled apps are now blocked from reading your clipboard just because the app is in the foreground.

The typical way of copy and pasting will still work, so as an example you can long press in a text box, tap paste, there’s the image again as you’d expect.

The workaround that GrapheneOS added, if I tap inside there, the keyboard now has this paste icon when something’s in your clipboard. So if I tap paste, again the image is pasted. That’s that workaround if you’re using a Flutter app or something else that monopolized your copy and paste functionality. You can now use that paste functionality on the keyboard to circumvent that.

And then as a last resort just in case you have an app that for some reason does require clipboard read access in the foreground and if you do have an app that requires that if you could comment that down below. I’m just curious what apps might make that a hard requirement to function. I also have anonymous comments on my blog if you prefer to leave it there.

But if you go back into settings where we change that clipboard permission, there’s the manage app access, tap on that. You can then select the app that needs that foreground read access, in this case currency converter, and change that to allow.

Now with that set to allow we go back into the currency converter app. Currency converter pasted from your clipboard and on the clipboard receiver we see our image.

But I highly suggest that everyone enables this feature. I’ve been using it for a few days. I found no downsides to it. And hats off to the GrapheneOS team, another fantastic privacy and security feature.

I also won’t be publishing this code anywhere for the app or the clipboard receiver. I see nothing positive that can come from that.

But that’s all I got. Hope you have a great rest of your day, and I’ll see you next time.